Hydraq

ATP Sandbox Adv. HeuristicsAV

Stats

First seen: April 2022
Last seen: September 2026

Also known as

AuroraMcRatMdmBot

MITRE ATT&CK techniques

19 techniques across 8 tactics.

TA0002 Execution

T1129Shared Modules
T1569System Services
- T1569.002Service Execution

TA0003 Persistence

T1543Create or Modify System Process
- T1543.003Windows Service

TA0005 Stealth

T1027Obfuscated Files or Information
T1070Indicator Removal
- T1070.004File Deletion
T1134Access Token Manipulation

TA0007 Discovery

T1007System Service Discovery
T1012Query Registry
T1016System Network Configuration Discovery
T1057Process Discovery
T1082System Information Discovery
T1083File and Directory Discovery

TA0009 Collection

T1005Data from Local System
T1113Screen Capture

TA0011 Command and Control

T1105Ingress Tool Transfer
T1573Encrypted Channel
- T1573.001Symmetric Cryptography

TA0010 Exfiltration

T1048Exfiltration Over Alternative Protocol

TA0112 Defense Impairment

T1112Modify Registry
T1685Disable or Modify Tools
- T1685.005Clear Windows Event Logs

Associated groups

Alert name variants

Alert Name	Engine
Gen:Variant.McRat.2	AV
Generic.Ransom.Aurora.30C0F8C2	AV
Trojan.McRat.1	AV
Win32.Backdoor.Hydraq	ATP Sandbox Adv. Heuristics
Win32.Backdoor.MdmBot	ATP Sandbox Adv. Heuristics
Win32.Ransomware.Aurora	ATP Sandbox Adv. Heuristics
Win32.Trojan.McRat	ATP Sandbox Adv. Heuristics
Win64.Trojan.Aurora	ATP Sandbox Adv. Heuristics

Related blogs

Threat Labs News Roundup: April 2023

May 8, 20234 min read

Related families

InvisiMole Cobalt Strike ZxShell SysUpdate PlugX